The U.S. Food and Drug Administration (FDA) convened a public workshop Jan. 30–31 to share experiences about its Software Precertification Pilot, an exploration of software industry culture and practices, and to obtain public feedback for the design of a new software precertification program, slated to launch by the end of the year.

Initiated in September 2017, the precertification pilot focused on considerations and variables for assessing the developers’ culture of software validation and maintenance. FDA staff visited nine companies of assorted scopes and sizes (Apple, Samsung, Fitbit, Johnson & Johnson, Phosphorus, Pear Therapeutics, Tidepool, Verily, and Roche) where they learned about industry characteristics and metrics that could help regulators establish precertification standards.

The agency’s overarching approach to the pilot and the future program is “firm-based,” meaning the companies — not the actual products — would be precertified based on historical performance in areas of regulatory interest. Depending on the program’s eventual implementation terms, a company with precertification status could avoid having to complete premarket submissions for their lower risk software products. Additionally, precertified companies could potentially benefit from more expeditious premarket reviews of their higher risk products.

Workshop panelists from industry generally supported the concept, though questions were posed about how the envisioned program would ultimately fit into the newly redefined boundaries of the FDA’s regulatory authority over software in the wake of the 21st Century Cures Act.

Provider and payer panelists were relatively more skeptical. They urged the the FDA to maintain a reasonable assurance of digital heath product safety and effectiveness from precertified developers. They argued that most physicians and other end-users would not differentiate between the various FDA pathways and said extensive outreach and education would be needed to ensure the medical community’s trust in a firm-based precertification model.